Virtual servers, multiple network interfaces

[vos123]

Hello,

A customer of us, has a virtual server farm based on VMware ESX ( with internal a virtual switch). Our network has multiple vlans per hosting switch ( 6500 CatOS, MSFC, IOS). We have 3 Catalyst switches for hosting, and each vlan has his own different identity.

What possible problems can we get, if the server fram is connected to different catalyst switches and different vlans. And more importent what can we do to prevent this kind of problems.

My main concern is that someone configure the virtual internal switch the wrong way or one virtual server in two vlans, or ip forwarding enabled etc, and hang the different hosting vlans.

Greetings,

Jeroen

[pflunkert]

Hi Jeroen,

i can imagine many problems. From Loops, to duplicate ip addresses or mac-addresses, or routing problems, security problems and so on. But the really important questions is, how you can prevent this. When the server have their own subnet i would configure every subnet as own vlan on the switch. Furthermore i would only permit specific mac-addresses on this port, so you can't learn another mac-addresses on the ports. Then you can you access-list to prevent traffic from the wrong side and to prevent possible routing loops. Normally i would recommend portfast, but here i'am thinking it's not good to use this feature. But i don't really know the possibilities of the VMWare. All this you should consider, when you implement the solution. The VMWare looks like a loadbalancer and so it should works.

I hope my statements can help you

Regards

Peter

[vos123]

Hi Peter,

There are two issuses i can't change in our configuration.

- There are more 'normal' hosts in the vlan's. So subnetting is not an option ( the subnet is a /24)

- The VMware server fram has two NIC's but can virtualy switch every 'virtuel server' between these NIC's. It is possible to use 1 NIC for multiple servers.

Bladeservers are identical to this VMware solution.

Greetings,

Jeroen

[pflunkert]

Hi Jeroen,

in this case you configuration could be very easy. When you configure the VMware, ensure that the traffic goes to and from one server have the same mac-address. Try to load-balance the traffic from the different servers to both switches and route th traffic to the server. So you can seperate the traffic to the VMware. Set on ly one vlan for both VMware Nics, so that no routing changes occurs.

Regards

Peter